{"id":"CVE-2026-74233","aliases":["EUVD-2026-67000","GHSA-2h7p-q23r-5gcf"],"status":"published","title":"Zbtlink MQWrt infosrvd Command Injection","description":"Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0337,"percentile":0.88909,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-321","CWE-78"],"published":"2026-08-27T10:40:11Z","modified":"2026-09-24T20:43:32Z","exploitation":[{"source":"euvd","since":"2026-08-27"}],"products":[{"vendor":"unknown","product":"ctn720-w1"},{"vendor":"unknown","product":"lf-1541"},{"vendor":"unknown","product":"mt7620n"},{"vendor":"unknown","product":"wrc1"},{"vendor":"zbtlink","product":"we1326"},{"vendor":"zbtlink","product":"we2426-c"},{"vendor":"zbtlink","product":"we357"},{"vendor":"zbtlink","product":"we5926"},{"vendor":"zbtlink","product":"we5926-ec_qp"},{"vendor":"zbtlink","product":"we5926-wd"},{"vendor":"zbtlink","product":"we826-q"},{"vendor":"zbtlink","product":"we826-t2"},{"vendor":"zbtlink","product":"we826-wd"},{"vendor":"zbtlink","product":"wf3526-p"},{"vendor":"zbtlink","product":"wg108"},{"vendor":"zbtlink","product":"wg3526"}],"references":[{"url":"http://vulncheck.com/blog/zbt-darklantern-speakingstone","tags":["technical-description","exploit"]},{"url":"https://www.vulncheck.com/advisories/zbtlink-mqwrt-infosrvd-command-injection","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74233"},{"url":"https://github.com/advisories/GHSA-2h7p-q23r-5gcf"}],"sources":{"cve":[{"id":"CVE-2026-74233","title":"Zbtlink MQWrt infosrvd Command Injection","description":"Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.","status":"published","published":"2026-08-27T10:40:11.313Z","modified":"2026-08-27T13:41:32.924Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-321","CWE-78"],"updated_at":"2026-11-02T14:20:03.4818Z"}],"euvd":[{"id":"EUVD-2026-67000","description":"Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.","status":"published","published":"2026-08-27T10:40:11Z","modified":"2026-08-27T13:41:32Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"exploited_since":"2026-08-27","updated_at":"2026-11-02T18:01:28.581047Z"}],"ghsa":[{"id":"GHSA-2h7p-q23r-5gcf","title":"Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware...","description":"Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.","status":"published","published":"2026-08-27T15:31:34Z","modified":"2026-08-27T15:31:35Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-74233","description":"Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.","status":"published","published":"2026-08-27T13:18:34.137Z","modified":"2026-09-24T20:43:32.537Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78","CWE-321"],"updated_at":"2026-11-02T14:12:42.035353Z"}]}}